Yesterday we received this email message through the contact form of our website from a russian server:
9th of April - SPOOF MESSAGE:
Name: John Surname: Smith EMail: pii-041570bf82880909f0aefee159d41349b9f2904e5bed6b48478e1a5473432277 Company: MyCompany Phone: 1178322276 Message: I'm testing the contact form, please ignore. IP Address: 220.127.116.11 Hostname: broadband-95-84-220-109.ip.moscow.rt.ru Location: 55.7527,37.6172 Organization: AS42610 PJSC Rostelecom City: Moscow Region: Moscow Country: RU Postal: 109548
The strange part is that 30 days earlier one of our employees indeed sent this message to test the form was working properly:
13th of March - REAL MESSAGE:
Name: John Surname: Smith EMail: firstname.lastname@example.org Company: MyCompany Phone: 1178322276 Message: I'm testing the contact form, please ignore. IP Address: 18.104.22.168 Hostname: line155.comsat.net.ar Location: -27.4806,-58.8341 Organization: AS7908 BT LATAM Venezuela, S.A. City: Region: Corrientes Country: AR Postal:
As you see the spoof message has the exact name, surname, company, phone and text content of the real one. How could the spoof sender determine this information?
Our site is hosted at an external hosting provider, and we are using PHPMailer, an Office365 account to send the message, and http://ipinfo.io/ to get the sender information.
Thanks in advance!